2019
VULNERABILITY
STATISTICS REPORTWELCOMEFor our 4th Year running, welcome to theedgescan Vulnerability Stats Report. This
report aims to demonstrate the state of fullstack security based on edgescan data for2018. The edgescan report has become areliable source for truly representing the
global state of cyber security.
This year we took a deeper look at
vulnerability metrics from a known
vulnerability (CVE) and visibility standpoint.
We still see high rates of known/patchable
vulnerabilities which have working exploits
in the wild, which possibly demonstrates it
is hard to patch production systems
effectively on a consistent basis.
Other metrics such as time-to-fix and risk
density, still show that it takes time to fix
vulnerabilities and it can be difficult to avoid
repeating the same mistakes.
Visibility is also a key driver to cyber security
and based on our continuous asset profiling
we discuss how common sensitive and criticalsystems are exposed to the public Internet.
The assumption here is that enterprises
simply did not have the visibility or systems
in place to make them aware and informthem of the exposure.
We also delve into “internal” cyber security,
looking at metrics which may not seem asimportant but are a valuable defence in thecase of APT, malware infection, ransomware
or other internal attacks, which leveragecommon vulnerabilities in corporate
networks to spread across the enterprise.
This report provides a glimpse of how toprioritize and focus on what is important,as not all vulnerabilities are equal.
Best regards,
Eoin Keary

EOIN KEARY
Founder,Edgescan.com

2018 – A REVIEWThe pace of system development is now faster than ever,with deployment of systems in the cloud, DevOps and theworld in continuous change. Overall a primary aspect ofmaintaining a robust and secure enterprise is Visibility.
Once we know that we have an issue, we generally act
upon it. Based on this years findings, we still do notdemonstrate strong situational awareness.
With the introduction of GDPR (25th May 2018),
it is now clearer than ever that security breaches
and non-compliance will result in tangible
costs to an organisation. Protection of Personal
Identifiable Information (PII) and sensitive data
is now a serious requirement with regulatory
penalties which could significantly damage
any company. Other regulations such as NIS(Network and Information Systems Directive)
drive the requirements for strong, repeatable
and measurable cyber security controls.

DevSecOps Toolchain Integration iscommonplace and still gaining traction, which
is an effective way to detect vulnerabilities indeveloped code and systems without slowing
down output. Some caveats exist with suchapproaches, such as accuracy, coverage andbusiness logic assessment, when using a purely
automated solution, but simple common
high-risk vulnerabilities can be detected quickly
and mitigated quickly when combining human
intelligence and “tuned” automation.

2018 was (another) year of the data breach,from airlines to health insurers, fromtelecommunications companies to traditional
industries such as hotel chains and retailorganisations, all of which reported breaches.
Some of these were via malware and others via
hacking attacks, but there is no sign of this levelof global breach slowing in 2019. The bottom lineis that a simple vulnerability or the absence of asimple control can result in catastrophic results.

Many people find the output of security tools
overwhelming due to the volume and inaccuracyof data presented. This needs to be addressed
so developers and system deployment teams
can focus and prioritise on risks which matterto the enterprise. As the saying goes “Not all
vulnerabilities are created equal”.

Many breaches via hacking attacks andmalware are preventable. Activities such as
security integration into the SDLC, DevSecOps,
patch management, continuous vulnerability
management and continuous asset profiling (i.e.
visibility), can help us identify and mitigate such
weaknesses before we deploy systems, or atleast before they become a real problem.

The world of the “annual pentest” is dead. We
deploy code and systems too frequently andtoo rapidly for traditional approaches to cybersecurity to keep pace with any meaningful effecton overall security posture. As an industry weshould embrace more automation coupled withhuman expertise to augment our capabilities as
professionals and become somewhat “bionic”.
edgescan™ January 2019

3

RISK DENSITY – INFRASTRUCTURE VS LAYER 7
In 2018 we discovered that on average, 19% of all vulnerabilities
were associated with (Layer 7) web applications, API’s, etc., and
81% were network vulnerabilities.

81%

19%

NETWORK
VULNERABILITIESAPPLICATION (LAYER 7)
VULNERABILITIES
FullstackVulnerability
View

2%High &
Critical
Risk

High &
Critical
Risk% OF HIGH & CRITICAL RISKISSUES IN NETWORK LAYER% OF HIGH & CRITICAL RISKISSUES IN WEB LAYER• The Risk Density is still high and has
not changed significantly from lastyears report.
• Even though we find more
vulnerabilities in the infrastructure
layer, the application layer is where
we find a higher degree of risk. This isdue to the “snowflake effect” – every
application is unique, developed ina stand-alone fashion and servesa unique purpose, as opposed toinfrastructure which is commoditised
and much more uniform.

419%• Change and uniqueness certainly
introduces additional risk.
• Internal, non-public application
layer security is worse – 24.9% of all
discovered vulnerabilities are High or
Critical Risk.

RISK DENSITY – NETWORK VS APP
Web Application security is still the area of most risk from asecurity breach standpoint. This year we have introduced bothpublic Internet and internal network views of the vulnerability
management landscape.
The percentage of High and Critical risks
combined, compared to all discovered risks is stillhigh at 19.2% for public Internet-facing (external)
applications and 24.9% for non-public or internal
applications.
This compares to a risk density of 20.7% forInternet-facing systems last year, which isroughly similar.

The high-risk density score of 24.3% forinternal-facing applications is worrisome
given many studies cite the “insider threat”
as a significant issue. Malware and ransomware
also target known vulnerabilities and can easily
exploit internal systems, should they get theopportunity to do so.
High and Critical Risk Density in Internet-facing(external) Infrastructure is still relatively low at
2% whilst internal infrastructure risk density ishigher, at 4.2%.

RISK DENSITY
EXTERNAL – NET

2%

0.2%
CRITICAL

1.8%
HIGH

10.2%

INTERNAL – NET

EXTERNAL
NETWORKMEDIUM

OF ALL
VULNERABILITIESDISCOVERED WERE
HIGH OR CRITICAL
RISK

10.2%

OF ALL
VULNERABILITIESDISCOVERED WEREMEDIUM RISK

87.8%
LOW

CRITICAL

3.4%
HIGH

22.2%

15.8%
HIGH

19.4%
MEDIUM

61.4%
LOW

EXTERNAL
WEB/APPOF ALL
VULNERABILITIESDISCOVERED WERE
HIGH OR CRITICAL
RISK

22.2%

OF ALL
VULNERABILITIESDISCOVERED WEREMEDIUM RISK

73.5%
LOW

INTERNAL – WEB

19.2%

CRITICALINTERNAL
NETWORKMEDIUM

EXTERNAL – WEB

3.4%

4.2%

0.8%

OF ALL
VULNERABILITIESDISCOVERED WERE
HIGH OR CRITICAL
RISK

19.4%

OF ALL
VULNERABILITIESDISCOVERED WEREMEDIUM RISK

24.9%

0.6%
CRITICAL

24.3%
HIGH

22.5%
MEDIUM

52.8%
LOW

INTERNAL
WEB/APPOF ALL
VULNERABILITIESDISCOVERED WERE
HIGH OR CRITICAL
RISK

22.5%

OF ALL
VULNERABILITIESDISCOVERED WEREMEDIUM RISK

5

VULNERABILITY TAXONOMYPreviously we have discussed the rates of vulnerability acrossboth Web Applications and Hosting environments. What is alsointeresting is to delve into what type of vulnerabilities are being
discovered. The following is a high level breakdown of the types
of issues being identified by edgescan™.

Below Layer 7

Layer 7

From a Host/Network perspective westill see a large % of issues are related to
Cryptography which covers issues such as
deprecated protocol support, CVE’s and poor
implementation.

From an application security standpoint,
insecure configuration is also a significant
issue, followed by client-side security. Injection
attacks are also relatively high given how
destructive they can be.

Weak configuration also gives rise toa significant percentage of discovered
vulnerabilities.

MOST COMMON INFRASTRUCTURE VULNERABILITIES IN 2018
• Common Vulnerabilities and Exposures(CVE®) is a list of common identifiers
for publicly known cyber security
vulnerabilities.
• Many systems have a CVE which
defines a security issue that is known
to the public. Generally there is a patchor workaround available to mitigate
the issue.
• Systems with exposed CVE’s generally
are not being patched regularly. It takes
time and effort to patch, but it appears
patching can still reduce ones exposure
to breaches and significantly increase
security.

6• CVE’s (Known Vulnerabilities) can bedetected quickly using a continuous
assessment model. Even though
your source code does not change, avulnerability may be discovered which
was previously unknown within the
security industry and may require
your attention.
• Continuous visibility and real-timealerting is the key to detecting CVE’s.

MOST COMMON INFRASTRUCTURE VULNERABILITIES IN 2018

1.29%

1.18%

0.82%

44.7%

Bypass of firewall rules bysending UDP packets witha source port equal to 53

A server with Microsoft
Windows where is it possible tolog into it using a NULL session

E.g. CVE-2003-1491,
CVE-2004-1473

E.g. No login ID or password
requred. CVE-1999-0519,
CVE-1999-0520, CVE-2002-1117

An attacker may be able
to use information to gain
more knowledge about the
remote system or change theconfiguration settings (if thedefault community allow suchmodifications).

Unsupported versions of SSL/
TLS enabled. Weak ciphers used.
Vulnerabilities to known SSL
CVE’s detected. SSL Certificate
expiry or “bad” certificates.

FIREWALL UDPPACKET SOURCE PORT
53 RULESET BYPASSMICROSOFT WINDOWSSMB NULL SESSIONAUTHENTICATIONSNMP AGENT DEFAULTCOMMUNITY NAME
(PUBLIC)

TLS & SSL VERSION& CONFIGURATIONISSUES

E.g. CVE-1999-0517

1.69%

UNSUPPORTED &UNPATCHED SERVER
DETECTION
Unpatched, unsupported servers
both *nix and Windows. 1000’sof CVE’s recorded against themas a result.

INFRASTRUCTURE
VULNERABILITIES

1.78%

2018

RETURN OF
BLEICHENBACHER’SORACLE THREAT(ROBOT) INFORMATIONDISCLOSURE
An adaptive-chosen ciphertext
attack: this attack fully breaks
the confidentiality of TLS whenused with RSA encryption.

4.15%
UNENCRYPTEDTELNET SERVICES

Insecure and unencrypted
protocol for data transfer.

6.25%

WINDOWS
REMOTE DESKTOP
PROTOCOL SERVER
MAN-IN-THE-MIDDLE
CVE’s such as CVE-2005-1794,
CVE-2014-0296, CVE-2015-2472,
CVE-2012-0002, CVE-2012-0152

8.61%

OpenSSH MULTIPLE
VULNERABILITIES &CONFIGURATIONISSUES

29.53%SMB SECURITY
ISSUES

SMB authentication,
known vulnerabilities, etc.

Issues such as SSH Weak MAC
Algorithms Enabled, SSH Server
CBC Mode Ciphers Enabled,
Exposed SSH service.
E.g. CVE-2018-15473,
CVE-2016-6210, CVE-2016-6515

As per previous years,
TLS, SSL issues top themost common listat 44.7%

SMB security issues
are also significant andare related to various mass
malware attacks in 2018

RDP (Remote Desktop)
vulnerabilities were also
relatively common andare a popular target for
attackers according to2018 threat intel

7

MOST COMMON WEB (LAYER 7) VULNERABILITIES

14.69%

12.36%

9.25%

8.18%

HTML Injection, Stored andReflected Cross-Site Scripting.
Template Injection. Generally
found due to a lack of or poor
contextual output encoding.

Unpatched, unmanaged,
known CVE (vulnerability).
Misconfigured components andinsecure defaults.

Weak passwords, Enumeration/
Leakage, Error related issues.

Injection attacks, Operating
system, Backend injection.
Pivoting attacks, Command
Shell and stepping stone attacks
to assist in total compromiseof hosting environment andassociated network.

CROSS SITE SCRIPTING/BROWSER SINK ATTACKSVULNERABLECOMPONENTS

WEAK
AUTHENTICATION

11.34%

6.3%

OTHER

EXTERNAL SERVICEINTERACTION

1.75%

Forceful control of target tointeract with external system.
When it is possible to induce anapplication to interact with anarbitrary external service.

CROSS SITE REQUESTFORGERY
An attack that forces an end user
to execute unwanted actions
on a web application in which
they’re currently authenticated.

5.72%

1.78%

SOURCE CODEDISCLOSURESESSION HANDLINGWEAKNESS

WEB (LAYER 7)
VULNERABILITIESBackend source code disclosuredue to error or poor application
design.

2018

Session management
weaknesses.

5.55%

1.82%

SQL INJECTION(& LDAP INJECTION)

DOM BASEDVULNERABILITY

Database attack via vulnerable
web application.

Client-side browser attacks,
Javascript attacks

4.62%

2.53%

SYSTEM EXPOSURE

OPEN REDIRECTION

Exposed Admin Console,
Directory traversal, Insecure
configuration exposure, Insecuredefaults.

Web application accepts
untrusted input that could cause
the web application to redirect
the request to a URL contained
within untrusted input.

2.81%

3.32%

3.6%

4.38%

Unauthorised data & functional
access weakness. Privilege
escalation, horizontal andvertical authorisation weakness.

Sensitive information & System
information disclosure. Poorerror handling.

Sensitive business information,
PII, Credentials, etc.

Successfully upload malicious
payload to target. No antivirus
or poor handling of untrusted
payloads.

AUTHORISATION
ISSUE

8

OTHER INJECTION(OS, CRLF, HTTP, XXE)

INFORMATIONDISCLOSURE/ERRORHANDLINGSENSITIVE
INFORMATIONDISCLOSURE

MALICIOUS FILEUPLOAD

Cross-Site Scripting, both reflected and stored,
was the most common vulnerability in 2018at 14.69%.
Vulnerable components were significant in 2018at 12.36%, which begs the question of the extent
to which organisations are managing software
component inventory and bill-of-materials. Many ofthe vulnerable components had known vulnerabilities
with working exploits available.
SQL Injection was also significant in 2018 at 5.55%, in
terms of how devastating the attack can be and how
easily it can be used to exploit entire systems.
Other Injection attacks such as OS, CRLF, JavaScript,
backend and template attacks were high in 2018 at
8.18%. Many of these vulnerabilities could resultin significant data/PII loss or attacks on audit
integrity controls (e.g. logs).

9

MOST COMMON CVE’S – EXTERNAL(EXCLUDING SSL RELATED ISSUES)
MOST COMMON HIGH AND CRITICAL CVE’S IN PUBLIC INTERNET FACING SYSTEMSThe following depicts the most common High and Critical Risk CVE’s discovered in the 12 months to December 2018 for public
Internet facing systems. It excludes SSL/TLS related issues due to the volume of issues, which tends to skew the overall results.
The “NotPetya” ransomware variant utilized in the 2017 attack uses EternalBlue, an exploit which takes advantage ofa vulnerability in Windows’ Server Message Block (SMB) protocol. EternalBlue is generally believed to have been developed by
the U.S. National Security Agency (NSA); it was leaked in April 2017 and was also used by WannaCry.

7.5% of allhigh and critical risk
vulnerabilities discoveredin 2018 related to exposure
to NotPetya CVE’s (CVE2017-0144, CVE-2017-0145) Windows SMB Remote Code
Execution VulnerabilityName

33.33% of allhigh and critical risk
vulnerabilities discoveredin 2018 were in relation tounsupported Windows
Server 2003 systems(no patching, support,
end-of-life systems)% of
all total CVSS
discovered Score

Systems running
PHP and Apache also
contributed to the Top 10
due to weak component
security and traditional
patch management of
exposed systems

CVE’s

Microsoft Windows Server 2003
33.33%
10
Unsupported system			CVE-2007-1765, CVE-2008-0015, CVE-2008-0020, CVE-2009-1923, CVE-2009-1924,

			

CVE-2009-3675, CVE-2010-0020, CVE-2010-0021, CVE-2010-0022, CVE-2010-0231,

			

CVE-2010-1886, CVE-2015-1768,CVE-2015-1768

MS14-066: Vulnerability in Schannel –CVE-2005-0416, CVE-2005-3483, CVE-2006-2373, CVE-2006-2374, CVE-2007-0038,

7.53%

10

CVE-2014-6321

7.53%

10

CVE-2015-1635

7.53%

9.3

Remote Code Execution
MS15-034: Vulnerability in HTTP.sys –Remote Code Execution
MS17-010: Security Update for Microsoft Windows

SMB Server ETERNALBLUE WannaCry Petya			
Microsoft Windows SMBv1 Various Vulnerabilities

6.45%

CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, CVE-2017-0146,
CVE-2017-0147,CVE-2017-0148

9.3

CVE-2017-0267, CVE-2017-0268, CVE-2017-0269, CVE-2017-0270, CVE-2017-0271,

			

CVE-2017-0272, CVE-2017-0273, CVE-2017-0274, CVE-2017-0275, CVE-2017-0276,

			

CVE-2017-0277, CVE-2017-0278, CVE-2017-0279,CVE-2017-0280

PHP 5.6.x < 5.6.33 Various Vulnerabilities

			CVE-2014-9425, CVE-2014-9709, CVE-2015-1351, CVE-2015-1352, CVE-2015-8383,
CVE-2015-8386, CVE-2015-8387, CVE-2015-8389, CVE-2015-8390, CVE-2015-8391,

			

CVE-2015-8393, CVE-2015-8394, CVE-2015-8865, CVE-2016-10158, CVE-2016-10159,

			

CVE-2016-10160, CVE-2016-10161, CVE-2016-3141, CVE-2016-3142, CVE-2016-4070,

			

CVE-2016-4071, CVE-2016-4072, CVE-2016-4073, CVE-2016-4537, CVE-2016-4539,

			

CVE-2016-4540, CVE-2016-4542, CVE-2016-5385, CVE-2016-5399, CVE-2016-6207,

			

CVE-2016-6289, CVE-2016-6290, CVE-2016-6291, CVE-2016-6292, CVE-2016-6293,

			

CVE-2016-6294, CVE-2016-6295, CVE-2016-6296,CVE-2016-6297, CVE-2016-7124,

			

CVE-2016-7125, CVE-2016-7126, CVE-2016-7127, CVE-2016-7128, CVE-2016-7129,

			

CVE-2016-7130, CVE-2016-7131, CVE-2016-7132, CVE-2016-9935, CVE-2017-11142,

			

CVE-2017-11143, CVE-2017-11144, CVE-2017-11145, CVE-2017-6004, CVE-2017-7890,

			

CVE-2017-9224, CVE-2017-9226, CVE-2017-9227, CVE-2017-9228, CVE-2017-9229,

			

CVE-2018-5711, CVE-2018-5712

6.45%

10

Apache Traffic Server 4.x < 4.2.1.1 / 5.x < 5.0.1
Synthetic Health Check Vulnerability

4.30%

10

CVE-2014-3525

Various Vulnerabilities

3.23%

10

CVE-2016-7406, CVE-2016-7407, CVE-2016-7408, CVE-2016-7409

HP Data Protector - Command Execution

3.23%

10

CVE-2011-0923

Remote Code Execution

3.23%

9.3

CVE-2012-0002, CVE-2012-0152

Other

17.20%

Dropbear SSH Server < 2016.72

MS12-020: Vulnerabilities in RDP –10

MOST COMMON CVE’S – INTERNAL(EXCLUDING SSL RELATED ISSUES)
MOST COMMON HIGH AND CRITICAL RISK INTERNAL NETWORK CVE’S
The following depicts the most common High and Critical Risk CVE’s discovered in the 12 months
to December 2018 for internal (non public Internet) network systems.

5.23% of all discoveredhigh and critical vulnerabilities
discovered related to exposure
to NotPetya, Wannacry,
Eternalblue CVE’s

8.76% of all discoveredhigh and critical risk vulnerabilities
related to unpatched windows 2003
systems which have a significant
list of known vulnerabilities

Internal security has always been considered the “Soft underbelly” in network security.
Given the spate of Ransomware and Malware attacks which occurred in 2018, the successful release of suchmalware would cause significant harm due to unpatched and poorly managed non Internet facing systems.

Name

% of
all total CVSS
discovered Score

Microsoft Windows SMBv1 Vulnerabilities

11.40%

CVE’s

9.3

CVE-2017-0267, CVE-2017-0268, CVE-2017-0269, CVE-2017-0270,

			

CVE-2017-0271, CVE-2017-0272, CVE-2017-0273, CVE-2017-0274,

			

CVE-2017-0275, CVE-2017-0276, CVE-2017-0277, CVE-2017-0278,

			

CVE-2017-0279, CVE-2017-0280

MS12-020: Vulnerabilities in Remote Desktop - RCE

10.30%

9.3

CVE-2012-0002,CVE-2012-0152

HP System Management Homepage < 6.3

9.36%

10

CVE-2010-1917, CVE-2010-2531, CVE-2010-2939, CVE-2010-2950,

Various Vulnerabilities			

CVE-2010-3709, CVE-2010-4008, CVE-2010-4156, CVE-2011-1540,

			CVE-2011-1541
Microsoft Windows Server 2003

10

CVE-2005-0416, CVE-2005-3483, CVE-2006-2373, CVE-2006-2374,

Unsupported Installation Detection			

8.76%

CVE-2007-0038, CVE-2007-1765, CVE-2008-0015, CVE-2008-0020,

			

CVE-2009-1923, CVE-2009-1924, CVE-2009-3675, CVE-2010-0020,

			

CVE-2010-0021, CVE-2010-0022, CVE-2010-0231, CVE-2010-1886,

			

CVE-2015-1768, CVE-2015-1768

HP Data Protector - Command Execution

5.84%

10

CVE-2011-0923

MS17-010: Security Update for Microsoft

5.23%

10

SMB Server – ETERNALBLUE, WannaCry, 			

CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, CVE-2017-0146,
CVE-2017-0147, CVE-2017-0148

EternalRocks, Petya
MS14-066: Vulnerability in Schannel - RCE

4.90%

10

CVE-2014-6321

HP Data Protector Remote Command Execution

4.74%

10

CVE-2011-0923

HP System Management Homepage

2.48%

7.8

CVE-2016-8743, CVE-2017-12544, CVE-2017-12545, CVE-2017-12546,< 7.6.1 Various Vulnerabilities (HPSBMU03753)			

CVE-2017-12547, CVE-2017-12548, CVE-2017-12549, CVE-2017-12550,

			

CVE-2017-12551, CVE-2017-12552, CVE-2017-12553

MS15-011: Vulnerability in Group Policy – RCE

CVE-2015-0008

1.98%

8.3

(3000483)
Other

35.20%		

11

EXPOSED SERVICES:ASSET PROFILING – OPEN PORT WALL OF SHAME
Continuous asset profiling detects exposed ports and services on the public
Internet. Unfortunately organisations can have systems exposed which gives
rise to an increased attack surface and the potential for a security breach.
Systems such as remote desktop, SMB, Database, Telnet etc.
Many exposed ports have been used for attacks such as WannaCry,
NotPetya, Mirai, ADB Miner, PyRoMine amongst others. Such exposed ports
can be victim to traditional hacking attacks which also give rise to breachand data loss.

Below depicts the percentage of systems facing the internet with exposed ports and services(Based on a sample of 250,000 assets under continuous profiling):

PORT 445

1.89%

3.05%

(SMB)

(RDP)
PORT 23

of
ll
a
W me
Sh a

0.3%
(Databases)

PORT 21

0.23%

0.95%

(Telnet)(FTP)

Remediation of this type of issue simply requires
a firewall change or services being shut down.
This sounds simple but the challenge is attaining
visibility in the first place. Continuous asset
profiling helps detect open services and when

12

PORT 3306,
1521, 1433, 1434

PORT 3389

coupled with an alerting mechanism to notify
one of an exposure, it is an easier challenge toaddress. Simply put, visibility helps reduce asystems attack surface, in a constantly changing
environment.

(CONTINUED)

The table below depicts the most commonly found exposed ports, mostof which should probably not be! These are based on a sample of 250,000
public Internet-facing assets under continuous profiling in the past 12
months to December 2018.
In total, 25.21% of all exposed ports as outlined in the table below, should
likely be protected or further protection considered. The ports listed are
frequently abused to commit a security breach or to help proliferatemalware attacks.

Common ports suchas Port 80 (HTTP)& Port 443 (HTTPS)
are obviously
not included

0.3% (750)exposeddatabases		ProtocolService Name/Description

3.05% (7,625)
exposed RDP(Remote Login Services)

2.65% (6,500)
exposed Redis
services(Redis is an in-memory
data structure store)% of all discovered
open ports

tcp

SSH

7.7868%tcp

RDP

3.0596%udp

SNMP

2.6502%

tcp

redis

2.0100%tcp

Microsoft RPC

1.9132%tcp

SMB

1.8983%

tcp

NetBIOS Session Service

1.7569%udp

ntp

1.5856%tcp

FTP

0.9529%tcp

DNS Firewall Port

0.7221%

tcp

Exposed Database

0.3059%tcp

Telnet0.2394%tcp

DHCP Server

0.1773%tcp

VNC

0.1507%

Total of all Ports discovered

25.21%

13

T2F (TIME TO FIX):
WEB APPLICATIONS & INFRASTRUCTURE
THE AVERAGE TIME TO FIX OR MITIGATE A VULNERABILITY DISCOVEREDIN THE APPLICATION (WEB) AND INFRASTRUCTURE LAYERSAPPLICATION

77.5

69 DAYSCRITICAL RISK

83 DAYSHIGH RISK

74 DAYSAPPLICATION(DAYS)MEDIUM RISKHIGH RISK

78 DAYSNETWORK(DAYS)

TIME TO FIX CRITICAL

Longest Time215 Days

TIME TO FIX HIGH

Shortest Time
0.2 Days

Longest Time198 Days

TIME TO FIX HIGH

Longest Time323 Days

TIME TO FIX MEDIUM

1464 DAYSLOW RISK/INFO

TIME TO FIX CRITICAL

Shortest Time
0.2 Days

81.75

CRITICAL RISK

120 DAYS

LOW RISK/INFO

Shortest Time
3 DaysAVERAGETIME TO CLOSE A
VULNERABILITYIN NUMBER
OF DAYS

65 DAYSMEDIUM RISK

84 DAYS

Shortest Time
1.25 Days

NETWORK

Shortest Time
8.8 Days

Longest Time
256 Days

TIME TO FIX MEDIUM

Longest Time
348 Days

Shortest Time
5.6 Days

Longest Time345 Days

AVERAGETIME TO CLOSE A
VULNERABILITYIN NUMBER
OF DAYS

The average windowof exposure for criticalinfrastructure vulnerabilities
is 65 days
The average windowof exposure for critical web
application vulnerabilities
is 69 days

15

PCI ASV VIEW
The Payment Card Industry Data Security Standard (PCI DSS) defines avulnerability with a base CVSS score of 4.0 or greater, as a compliance Fail.
edgescan™ is a certified PCI Approved Scanning Vendor (ASV) and assistsclients with PCI DSS compliance by leveraging its full stack security
assessment technology and technical support.

68%

57%

22%

FULLSTACKVIEWNETWORKVIEWWEB
APPLICATION
VIEW

68% OF ALL
VULNERABILITIES DISCOVEREDIN 2018 HAD A SCORE EQUAL
TO OR HIGHER THAN
4.0 – PCI DSS FAIL

57% OF ALL NETWORK LAYERVULNERABILITIES DISCOVEREDIN 2018 HAD A SCORE EQUAL
TO OR HIGHER THAN
4.0 – PCI DSS FAIL

22% OF ALL WEB APPLICATIONVULNERABILITIES DISCOVEREDIN 2018 HAD A SCORE EQUAL
TO OR HIGHER THAN
4.0 – PCI DSS FAIL

Common Vulnerability Scoring System (CVSS) base score ( http://www.first.org/cvss/ ), as indicated in the National
Vulnerability Database (NVD) where applicable ( http://nvd.nist.gov/cvss.cfm ).

CVE – COMMON VULNERABILITIES AND EXPOSURESHTTPS://CVE.MITRE.ORG/

Common Vulnerabilities
and Exposures (CVE®) is a list ofcommon identifiers for publicly known
cyber security vulnerabilities.

Systems with CVE’s exposed generally are notbeing patched regularly. It takes time and effort
to patch, but it appears patching can still reduceones exposure to breach and increase security
posture significantly.

16

Many systems have a CVE which defines
a security issues known to the public.
Generally there is a workaround ora patch to mitigate this issue.

CVE’s (Known Vulnerabilities) can be detected
quickly using a continuous assessment model.
Even though your source code does not change,
a vulnerability may be discovered which may
require your attention; Continuous visibility is
the key to detecting CVE’s.

CVE LANDSCAPE
Oldest CVE in 2018:
CVE-1999-0017

Most Common in 2018:
CVE-2015-2808

Systems with Multiple
Vulnerabilities“FTP servers canallow an attacker toconnect to arbitrary ports on
machines other than the FTP
client, aka FTP bounce”*“The RC4 algorithm, as usedin the TLS protocol and SSL
protocol, does not properly
combine state data with key
data during the initialization
phase, which makes it easierfor remote attackers to
conduct plaintext-recovery
attacks against the initial bytes
of a stream by sniffing network
traffic that occasionally relies
on keys affected by theInvariance Weakness, and thenusing a brute-force approach
involving LSB values, aka the“Bar Mitzvah” issue.”*

81.58% of systems
had at least one CVE

CVSS: 7.5

72.11% of systems
had more than one CVE
Interestingly,
20.57% of systems
had more than 10 CVEs

CVSS: 4.3
*As per NIST National Vulnerability Database (NVD) https://nvd.nist.gov/% OF ALL DISCOVERED CVE’S

EXTERNAL

INTERNAL

30%

25%

20%

15%

10%

5%

0%

9
19

9

20

00

20

01

20

02

20

03

20

04

20

05

20

06

20

07

20

08

20

09

20

10

20

11

20

12

20

13

20

14

20

15

20

16

20

17

20

18

#ProTip: Patching and version maintenance is still a key part of maintaining a secure posture. Manysystems have vulnerabilities which simply have not been discovered yet; once they are, a patch is usuallyavailable shortly after. It is recommended to keep pace with patching.

17

CONCLUSION
AWARENESSVISIBILITY

Application security needs tobecome a board-level conversation
in your organization, if it is notalready.

Improve situational awarenessof your estate at any given time,
helping mitigate even relatively
simple issues. Move to a positionof strong visibility as we cannot
improve on what we do not know.

MEASUREManagement sponsorship for
application security should be
result-oriented to help raise yourorganisations security posture.
REWARD

Rewarding of development teams
and gamification, including metrics
and measuring the security postureof businesses applications, should
be considered.
CAPABILITY

Security champions need tohave the resources and services
they require to identify and fix
vulnerabilities in software andsupporting hosting environments
faster.

TEAM

Work with IT and operations toapply scheduled maintenancewindows, aimed at updating
systems and frameworks withsecurity patches using a risk
based approach.
KNOWLEDGE

Developer training, frequent
software assessment early in thedevelopment lifecycle and security
analytics, are key to implementing asecurity program that compliments
your organisations softwaredevelopment lifecycle.

BILL OF MATERIALS

Understand the compositionof software applications andprioritize the vulnerable libraries
and frameworks for your teams
to maintain.

18© 2019. BCC Risk Advisory Ltd. | www.bccriskadvisory.com

edgescan™ Portal

ABOUT EDGESCAN™
SaaS: edgescan™ is a ‘Security-as-a-Service (SaaS)’
vulnerability management service which detects
vulnerabilities in both web application and hosting
infrastructure alike.
Hybrid Scalable Assessments: edgescan™ detects
both known (CVE) vulnerabilities and also web
application vulnerabilities unique to the application
being assessed due to our hybrid approach.
Analytics & Depth: Coupling leading edge risk
analytics, production-safe automation and human
intelligence, edgescan™ provides deep authenticatedand unauthenticated vulnerability assessment acrossall layers of a systems technical stack. Historical data tomeasure your risk profile over time. Effortless visibility
into your fullstack security posture at-a-glance– Vulnerability Intelligence.
Coverage: edgescan™ provides “fullstack vulnerability
management” covering both hosting environments,
component & frameworks and developer-written code.
Our edgescan advanced™ license even covers businesslogic and advanced manual testing techniques.
Support: Dedicated expert support from seasoned
penetration testers and developers, to provide advice
and remediation guidance.
Accuracy/Human Intelligance: All vulnerabilities
discovered by edgescan™ are verified by ourengineering team to help ensure they are a real risk andprioritised appropriately for our clients. Our analysts
eliminate false positives and streamline the remediation
process, saving valuable developer time and resources.
Rich API Integration: Our API makes it simple to plugedgescan™ into your ecosystem in order to correlate
and reconcile, providing integration with both GRC
and Bug Tracking and DevSecOps Systems alike.
One-click WAF: Rule generation supporting a variety offirewalls is also supported, helping you virtually-patch
discovered vulnerabilities.
Alerting: Customise Alerting via email, SMS, Webhooks,
Slack, API etc, based on custom criteria.
Continuous Asset Profiling: Continuous profilingof the entire Internet-facing estate detecting changes
in estate profile and eliminating blind spots.
Scale: Managing estates from one web application
to thousands, from a single hosting environment
to global cloud infrastructure, edgescan™ delivers
continuous vulnerability intelligence, support andtesting-on-demand.
Compliance: edgescan™ is a certified PCI ASV anddelivers testing covering the OWASP Top 10, WASC
threat classification, CWE/SANS Top 25, etc.
On-demand: Via the portal or API, request retests,
ad-hoc scans as much as you need at no extra cost.
All with the added comfort of validated findings andexpert support.

20 MOST PROMISINGENTERPRISE SECURITY
SOLUTION PROVIDERS - 2017

FULLSTACK VULNERABILITY MANAGEMENT

IRL: +353 (0) 1 6815330
UK: +44 (0) 203 769 0963
US: +1 646 630 8832
Sales and general enquiries:
sales@edgescan.com@edgescanwww.edgescan.com